Linux · 
Oracle Linux · Security advisory · October 30, 2019
Oracle Linux · Security advisory · October 30, 2019ELSA-2019-3237: thunderbird security update
ELSA-2019-3237, released October 30, 2019, fixes 9 CVEs in thunderbird (version 0:68.2.0-1.0.1.el8_0). None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
9
8 rated Critical
Exploited
0
None reported
Highest CVSS
8.8
Base score, 0 to 10
Highest EPSS
0.0664
93rd percentile
Priority of the 9 CVEs
Patch now 0
Urgent 8
High 1
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| thunderbird | ol 8 | 0:68.2.0-1.0.1.el8_0 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Urgent | CVE-2019-11759 | Firefox ESR: An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on… | 8.8 | 0.0165 | None reported |
| Urgent | CVE-2019-11764 | Firefox ESR: Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox… | 8.8 | 0.0147 | None reported |
| Urgent | CVE-2019-11760 | Firefox ESR: A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. | 8.8 | 0.0137 | None reported |
| Urgent | CVE-2019-11757 | Firefox ESR: When following the value's prototype chain, it was possible to retain a reference to a locale, delete… | 8.8 | 0.0133 | None reported |
| Urgent | CVE-2019-11758 | Firefox ESR: Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security… | 8.8 | 0.0133 | None reported |
| Urgent | CVE-2019-11763 | Firefox ESR: Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly… | 6.1 | 0.0115 | None reported |
| Urgent | CVE-2019-11761 | Firefox ESR: By using a form with a data URI it was possible to gain access to the privileged JSONView object that… | 5.4 | 0.0079 | None reported |
| Urgent | CVE-2019-11762 | Firefox ESR: If two same-origin documents set document.domain differently to become cross-origin, it was possible… | 6.1 | 0.0061 | None reported |
| High | CVE-2019-15903 | Python 3.6 and 2 others: Out-of-bounds Read | 7.5 | 0.0664 | None reported |
Showing 1 to 9 of 9
1
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.